Method TestTLS_CipherSuitesOverridable

credentials/tls_ext_test.go:335–408

Tests that CipherSuites is not overridden when it is set.

(t *testing.T)

// Tests that CipherSuites is not overridden when it is set.
func (s) TestTLS_CipherSuitesOverridable(t *testing.T) {
	ctx, cancel := context.WithTimeout(context.Background(), defaultTestTimeout)
	defer cancel()

	testCases := []struct {
		name      string
		serverTLS func() *tls.Config
	}{
		{
			name: "base_case",
			serverTLS: func() *tls.Config {
				return &tls.Config{
					Certificates: []tls.Certificate{serverCert},
					CipherSuites: []uint16{tls.TLS_RSA_WITH_AES_128_CBC_SHA},
				}
			},
		},
		{
			name: "fallback_to_base",
			serverTLS: func() *tls.Config {
				config := &tls.Config{
					Certificates: []tls.Certificate{serverCert},
					CipherSuites: []uint16{tls.TLS_RSA_WITH_AES_128_CBC_SHA},
				}
				config.GetConfigForClient = func(*tls.ClientHelloInfo) (*tls.Config, error) {
					return nil, nil
				}
				return config
			},
		},
		{
			name: "dynamic_using_get_config_for_client",
			serverTLS: func() *tls.Config {
				return &tls.Config{
					GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) {
						return &tls.Config{
							Certificates: []tls.Certificate{serverCert},
							CipherSuites: []uint16{tls.TLS_RSA_WITH_AES_128_CBC_SHA},
						}, nil
					},
				}
			},
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			// Create server that allows only a forbidden cipher suite.
			serverCreds := credentials.NewTLS(tc.serverTLS())
			ss := stubserver.StubServer{
				EmptyCallF: func(context.Context, *testpb.Empty) (*testpb.Empty, error) {
					return &testpb.Empty{}, nil
				},
			}

			// Create server that allows only a forbidden cipher suite.
			clientCreds := credentials.NewTLS(&tls.Config{
				ServerName:   serverName,